Azure AD Record updates during Autopilot with Hybrid Join
I was recently asked why when devices get Autopilot registered, an AAD Record gets created with Join type as Azure AD Join, and if that has an impact on the success of a Hybrid Azure AD Join scenario.
Here’s an example when a device is registered but hasn’t run through enrollment/provisioning yet from https://aad.portal.azure.com/. The device record with the purple icon is automatically created with the device serial number during registration.
Once enrollment has started but before AAD Sync uploads the device from AD, the record becomes enabled and updated with a temporary name:
Once the domain join profile gets processed but before the sync from AD (before user logs on), the record is updated with the domain join profile naming convention.
Shortly after Azure AD Connect synchronizes the AD object to AAD (after user logon), the service creates an actual device record with the correct join type.
Purple Icon is always going to be the Autopilot registration record, the one with a computer icon is the device record sync'd from AD with the proper join type.
To complicate things further there’s also a known issue where if you’re trying to manage a static Device group via Endpoint Management portal, you’ll see duplicate entries because one is the AAD record and the other is the Intune record, but there's no distinction via icons like in AAD portal.
Either way, that purple Autopilot registration record’s join type doesn’t have any bearing on the success of Hybrid join, it’s just one of Microsoft’s wacky design choices ??.